Transmission of data through a communications network has become a commonplace activity in modern life and business. Indeed transmission of data through communications networks such as the public internet, or other packet-based communications networks, has become an activity that is a necessary part of most business structures, including transmission of data from PC's and laptops as well as transmission of data from business related network access devices such as customer service terminals and automated bank machines. Oftentimes the nature of the data being transmitted through the communications network from these devices can be of a sensitive nature, including business information, credit card or debit card numbers, including passwords, as well as personal financial information and the like.
In general, sensitive data will be encrypted prior to transmission through the communications network in a manner that is well known in the art: a pre-defined scheme is used to encrypt data at the originating device using an encryption key. The data is transmitted to a destination device where it is decrypted using a decryption key complementary to the encryption key. There are many methods for producing and exchanging the keys which are well known to those of skill in the art. One such encryption method is known as RSA, which is a public key encryption system widely used in electronic commercial protocols as disclosed in U.S. Pat. No. 4,405,829 by Rivest et al. and hereby incorporated by reference herein.
Encryption of data is often used in combination with a “tunnel” through a communications network, such as a virtual private network (VPN) or a permanent virtual circuit (PVC). In particular a VPN “tunnel” provides secure transmission of data through the communications network by encapsulating one protocol or data transfer session inside another. In a VPN, the message to be sent from the originating device to the destination device is encrypted at the originating device using an encryption scheme known by the destination device, for example an RSA encryption scheme. The encrypted message will include the data of interest, as well as data relevant to the transmission. Data relevant to the transmission can include header information, etc.
The encrypted message is then transmitted to the destination device, using methods well known to those of skill in the art. The destination device receives the message and subsequently decrypts it. After decryption, it appears to the destination device as if the decrypted message was sent directly to the destination device through the communications network, without encryption, using the original transmission data.
In one such scheme for establishing a VPN, an encryption key generator within a client at the originating location is provided with a seed. The encryption key generator uses the seed to generate a first encryption key. This is passed to an encrypting client, which uses the first encryption key to encrypt the data to be transmitted. A header is then attached to the encrypted data and the encrypted data is transmitted to the destination device, through the communication network, such as the public internet. The destination device has been pre-provisioned with a decryption key generator, as well as a seed complementary to the one provided to the encryption key generator; in general the encryption and decryption seeds are the same seed. The decryption key generator uses the seed to produce a first decryption key, complementary to the first encryption key, which is passed to a decrypting client at the destination, which in turn decrypts the encrypted data.
After a period of time, the first encryption key is passed to the input of the encryption key generator, in essence to be used as a new encryption seed, to produce a second encryption key. Again, after another period of time has elapsed, the second encryption key is passed to the input of the encryption key generator to produce a third encryption key. This process continues during the entire encryption session as a means to discourage unauthorized users from discovering the current encryption key and gaining access to the data. A similar process occurs at the destination location to generate a complementary decryption key each time a new encryption key is generated. A synchronization step may occur at the beginning of this process or further be synchronized by a common clock or pre-synchronized clocks, to ensure that the current decryption key is always complementary to the current encryption key.
Generation of the seed for the encryption key generator and the decryption key generator is crucial to this process. In the RSA scheme referred to previously, a user is provided with a seed generating device which provides a seed to the user, which is entered into the encryption key generator to begin the cycle of key generation. Often, the user will also enter a permanent password which is combined with the seed provided by the seed generating device to create a combined seed which is used to begin the cycle of key generation. While the seed generating device is often enabled to produce a seed periodically, for example every 60 seconds, the user uses only one seed for the entire session. To ensure that the generated decryption keys are complementary to the encryption keys, the decryption key generator must be provisioned with a seed generator synchronized with the user's seed generator, as well as the user's permanent password.
A common problem associated with this scheme is that if a malicious user understands the algorithm for generating keys, and can learn the original seed for the session, including the user's permanent password, used to generate the keys, or a key fed back into the key generator, it is possible to intercept the encrypted data on the communication network and decrypt it, hence compromising the integrity of the encrypted data. Hence there is a risk that providing a single seed for a session may not be adequate to fully protect the sensitive data in question. In particular, certain business institutions such as banks and brokerages may be particularly sensitive to the possibility of information being cracked by a malicious user.
There remains a need therefore for an improved system and method for encrypting data on a network.